fix(crowdnode): disable all crowdnode functions except withdraw for existing accounts#1490
Conversation
…he view for no username
…gets the tx before the app sends it
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR makes address-marking idempotent, exposes CrowdNode sign-up state to viewmodels, gates staking/account UI and shortcuts by that state, pins the recaptcha Gradle dependency, and adds CrowdNode integration documentation. ChangesCrowdNode Feature Gating and Metadata Idempotency
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
integrations/crowdnode/src/main/java/org/dash/wallet/integrations/crowdnode/ui/portal/PortalFragment.kt (1)
224-237: 💤 Low valueConsider removing unused deposit-enablement logic.
setDepositsEnabledis still called (line 201, 226) but has no effect sincedepositBtnis now permanently hidden (line 138). This function can be removed in a future cleanup to reduce dead code.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@integrations/crowdnode/src/main/java/org/dash/wallet/integrations/crowdnode/ui/portal/PortalFragment.kt` around lines 224 - 237, The setDepositsEnabled(Coin) method is dead because depositBtn is permanently hidden; remove the unused method and all calls to setDepositsEnabled (search for setDepositsEnabled(...) usages) to eliminate dead code, and run a build to ensure no remaining references; if backward compatibility is required temporarily, replace callers with a no-op comment or feature-flag check instead of leaving the method in place.wallet/src/de/schildbach/wallet/ui/explore/ExploreEntryViewModel.kt (1)
27-27: ⚡ Quick winConsider consolidating ViewModel state into a single UIState data class.
ExploreEntryViewModelexposes three separateLiveDataproperties (stakingAPY,isBlockchainSynced,hasCrowdNodeAccount) rather than a single reactiveUIState. As per coding guidelines, ViewModels should use a singleUIStatedata class withStateFlow. The new field follows the existing pattern, so this isn't a regression, but consolidating into a single state holder would improve maintainability and align with the project's architectural standards.Also applies to: 38-50
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@wallet/src/de/schildbach/wallet/ui/explore/ExploreEntryViewModel.kt` at line 27, ExploreEntryViewModel currently exposes three separate observables (stakingAPY, isBlockchainSynced, hasCrowdNodeAccount); consolidate them into a single UIState data class and expose it as a MutableStateFlow/StateFlow from ExploreEntryViewModel instead of multiple LiveData fields; create a data class (e.g., ExploreUiState) containing those three properties, replace the individual LiveData/MutableLiveData with a private MutableStateFlow<ExploreUiState> and a public StateFlow<ExploreUiState>, update all places that set stakingAPY/isBlockchainSynced/hasCrowdNodeAccount to atomically update the state via .update { it.copy(...) } in ExploreEntryViewModel, and adjust consumers to observe the single StateFlow (or convert to LiveData if needed).Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build.gradle`:
- Around line 84-88: The forced ReCAPTCHA version pin in the configurations.all
-> resolutionStrategy block currently forces
'com.google.android.recaptcha:recaptcha:18.4.0'; either update that forced
coordinate to the current non-deprecated version ('18.9.1') or keep 18.4.0 but
add an inline comment immediately above the force call explaining why 18.4.0 is
required (e.g., compatibility/regression test link or vendor guidance) and
reference the deprecation note; modify the force string in the
resolutionStrategy.force call or add the explanatory comment next to that force
call accordingly.
---
Nitpick comments:
In
`@integrations/crowdnode/src/main/java/org/dash/wallet/integrations/crowdnode/ui/portal/PortalFragment.kt`:
- Around line 224-237: The setDepositsEnabled(Coin) method is dead because
depositBtn is permanently hidden; remove the unused method and all calls to
setDepositsEnabled (search for setDepositsEnabled(...) usages) to eliminate dead
code, and run a build to ensure no remaining references; if backward
compatibility is required temporarily, replace callers with a no-op comment or
feature-flag check instead of leaving the method in place.
In `@wallet/src/de/schildbach/wallet/ui/explore/ExploreEntryViewModel.kt`:
- Line 27: ExploreEntryViewModel currently exposes three separate observables
(stakingAPY, isBlockchainSynced, hasCrowdNodeAccount); consolidate them into a
single UIState data class and expose it as a MutableStateFlow/StateFlow from
ExploreEntryViewModel instead of multiple LiveData fields; create a data class
(e.g., ExploreUiState) containing those three properties, replace the individual
LiveData/MutableLiveData with a private MutableStateFlow<ExploreUiState> and a
public StateFlow<ExploreUiState>, update all places that set
stakingAPY/isBlockchainSynced/hasCrowdNodeAccount to atomically update the state
via .update { it.copy(...) } in ExploreEntryViewModel, and adjust consumers to
observe the single StateFlow (or convert to LiveData if needed).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2050712b-0ba3-4774-87c8-b1e8531f56de
📒 Files selected for processing (8)
build.gradleintegrations/crowdnode/src/main/java/org/dash/wallet/integrations/crowdnode/ui/entry_point/EntryPointFragment.ktintegrations/crowdnode/src/main/java/org/dash/wallet/integrations/crowdnode/ui/portal/PortalFragment.ktwallet/src/de/schildbach/wallet/database/dao/AddressMetadataDao.ktwallet/src/de/schildbach/wallet/service/WalletTransactionMetadataProvider.ktwallet/src/de/schildbach/wallet/ui/explore/ExploreEntryViewModel.ktwallet/src/de/schildbach/wallet/ui/explore/ExploreFragment.ktwallet/src/de/schildbach/wallet/ui/main/shortcuts/ShortcutsViewModel.kt
| configurations.all { | ||
| resolutionStrategy { | ||
| force 'com.google.android.recaptcha:recaptcha:18.4.0' | ||
| } | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for security advisories for com.google.android.recaptcha:recaptcha
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: MAVEN, package: "com.google.android.recaptcha:recaptcha") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: dashpay/dash-wallet
Length of output: 112
🌐 Web query:
What is the latest version of com.google.android.recaptcha:recaptcha library and are there any security advisories for version 18.4.0?
💡 Result:
As of June 9, 2026, the latest version of the com.google.android.recaptcha:recaptcha library is 18.9.1 [1][2]. Regarding version 18.4.0, there was a critical security vulnerability discovered that affected Android SDK versions 18.0.0 through 18.3.0 [3]. Version 18.4.0 was released specifically to address and patch this security issue [4][5][3]. Consequently, version 18.4.0 itself is not the subject of an advisory but rather the solution to a vulnerability present in older versions [4][3]. Users of affected older versions were strongly encouraged to update to version 18.4.0 or higher [4][6][5]. Note that version 18.4.0 is now classified as a deprecated version under the official mobile SDK deprecation policy [7].
Citations:
- 1: https://cloud.google.com/recaptcha/docs/release-notes
- 2: https://docs.cloud.google.com/recaptcha/docs/instrument-android-apps?hl=it
- 3: https://docs.cloud.google.com/recaptcha/docs/release-notes
- 4: https://github.com/googlecloudplatform/recaptcha-enterprise-mobile-sdk
- 5: reCAPTCHA Enterprise update firebase/firebase-android-sdk#5638
- 6: https://support.google.com/googleplay/android-developer/thread/256942736/a-critical-security-vulnerability-was-discovered-in-recaptcha-enterprise-for-mobile?hl=en
- 7: https://cloud.google.com/recaptcha/docs/deprecation-policy-mobile
Update/document the forced ReCAPTCHA version pin (18.4.0) in build.gradle.
com.google.android.recaptcha:recaptchais forced to18.4.0atbuild.gradle:84-88.- No public security advisories surfaced for this exact pinned dependency in the advisory lookup, but official ReCAPTCHA mobile docs classify
18.4.0as deprecated and the latest version is18.9.1. - Update the forced version (or keep it only with an inline comment explaining why
18.4.0is still required).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@build.gradle` around lines 84 - 88, The forced ReCAPTCHA version pin in the
configurations.all -> resolutionStrategy block currently forces
'com.google.android.recaptcha:recaptcha:18.4.0'; either update that forced
coordinate to the current non-deprecated version ('18.9.1') or keep 18.4.0 but
add an inline comment immediately above the force call explaining why 18.4.0 is
required (e.g., compatibility/regression test link or vendor guidance) and
reference the deprecation note; modify the force string in the
resolutionStrategy.force call or add the explanatory comment next to that force
call accordingly.
…ling functions except for withdrawals.
…sh-wallet into fix/disable-crowdnode
2 participants
Issue being fixed or feature implemented
Disable most CrowdNode functions, except for withdraw on existing accounts
Related PR's and Dependencies
Screenshots / Videos
How Has This Been Tested?
Checklist:
Summary by CodeRabbit
Refactor
Chores
Bug Fixes
Documentation